Recent research in quantum cryptography has led to the development of schemes that encrypt and authenticate quantum messages with computational security. The security definitions used so far in the literature are asymptotic, game-based, and not known to be composable. We show how to define finite, composable, computational security for secure quantum message transmission. The new definitions do not involve any games or oracles, they are directly operational: a scheme is secure if it transforms an insecure channel and a shared key into an ideal secure channel from Alice to Bob, i.e., one which only allows Eve to block messages and learn their size, but not change them or read them. By modifying the ideal channel to provide Eve with more or less capabilities, one gets an array of different security notions. By design these transformations are composable, resulting in composable security.
Crucially, the new definitions are finite. Security does not rely on the asymptotic hardness of a computational problem. Instead, one proves a finite reduction: if an adversary can distinguish the constructed (real) channel from the ideal one (for some fixed security parameters), then she can solve a finite instance of some computational problem. Such a finite statement is needed to make security claims about concrete implementations.
We then prove that (slightly modified versions of) protocols proposed in the literature satisfy these composable definitions. And finally, we study the relations between some game-based definitions and our composable ones. In particular, we look at notions of quantum authenticated encryption and QCCA2, and show that they suffer from the same issues as their classical counterparts: they exclude certain protocols which are arguably secure.
Quantum key distribution (QKD) protocols make it possible for two parties to generate a secret shared key. One of the most important QKD protocols, BB84, was suggested by Bennett and Brassard in 1984. Various proofs of unconditional security for BB84 have been suggested, but the first security proofs were not composable. Here we improve a security proof of BB84 given by [Biham, Boyer, Boykin, Mor, and Roychowdhury, J. Cryptology, 19(4):381-439, 2006] to be composable and match the state-of-the-art results for BB84, and we extend it to prove unconditional security of several variants of the BB8…
We consider a setup in which the channel from Alice to Bob is less noisy than the channel from Eve to Bob. We show that there exist encoding and decoding which accomplish error correction and authentication simultaneously; that is, Bob is able to correctly decode a message coming from Alice and reject a message coming from Eve with high probability. The system does not require any secret key shared between Alice and Bob, provides information theoretic security, and can safely be composed with other protocols in an arbitrary context.
We present a simplified framework for proving sequential composability in the quantum setting. In particular, we give a new, simulation-based, definition for security in the bounded-quantum-storage model, and show that this definition allows for sequential composition of protocols. Damgard et al. (FOCS '05, CRYPTO '07) showed how to securely implement bit commitment and oblivious transfer in the bounded-quantum-storage model, where the adversary is only allowed to store a limited number of qubits. However, their security definitions did only apply to the standalone setting, and it was not clea…
Quantum Cryptography uses the counter-intuitive properties of Quantum Mechanics for performing cryptographic tasks in a secure and reliable way. The Quantum Key Distribution (QKD) protocol BB84 has been proven secure against several important types of attacks: collective attacks and joint attacks. Here we analyze the security of a modified BB84 protocol, for which information is sent only in the z basis while testing is done in both the z and the x bases, against collective attacks. The proof follows the framework of a previous paper (Boyer, Gelles, and Mor, 2009), but it avoids a classical in…
Delegating difficult computations to remote large computation facilities, with appropriate security guarantees, is a possible solution for the ever-growing needs of personal computing power. For delegated computation protocols to be usable in a larger context---or simply to securely run two protocols in parallel---the security definitions need to be composable. Here, we define composable security for delegated quantum computation. We distinguish between protocols which provide only blindness---the computation is hidden from the server---and those that are also verifiable---the client can check…
We give the first composable security proof for continuous-variable quantum key distribution with coherent states against collective attacks. Crucially, in the limit of large blocks the secret key rate converges to the usual value computed from the Holevo bound. Combining our proof with either the de Finetti theorem or the Postselection technique then shows the security of the protocol against general attacks, thereby confirming the long-standing conjecture that Gaussian attacks are optimal asymptotically in the composable security framework. We expect that our parameter estimation procedure, …
Measurement-device-independent quantum key distribution protocol, whose security analysis does not rely on any assumption on the detection system, can immune the attacking against detectors. We give a first composable security analysis for continuous-variable measurement-device-independent quantum key distribution using squeezed states against general coherent attacks. The security analysis is derived based on the entanglement-based scheme considering finite size effect. A version of entropic uncertainty relation is exploited to give a lower bound on the conditional smooth min-entropy by trust…
The existing unconditional security definitions of quantum key distribution (QKD) do not apply to joint attacks over QKD and the subsequent use of the resulting key. In this paper, we close this potential security gap by using a universal composability theorem for the quantum setting. We first derive a composable security definition for QKD. We then prove that the usual security definition of QKD still implies the composable security definition. Thus, a key produced in any QKD protocol that is unconditionally secure in the usual definition can indeed be safely used, a property of QKD that is h…
We consider schemes for secret key distribution which use as a resource correlations that violate Bell inequalities. We provide the first security proof for such schemes, according to the strongest notion of security, the so called universally-composable security. Our security proof does not rely on the validity of quantum mechanics, it solely relies on the impossibility of arbitrarily-fast signaling between separate physical systems. This allows for secret communication in situations where the participants distrust their quantum devices.
Blind quantum computing [A. Broadbent, J. Fitzsimons, and E. Kashefi, Proceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science 517 (2009)] is a secure cloud quantum computing protocol which enables a client (who does not have enough quantum technology at her disposal) to delegate her quantum computation to a server (who has a universal quantum computer) without leaking any relevant information to the server. In [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)], a new blind quantum computing protocol, so called the measuring-Alice protocol, was proposed. …
Continuous-variable quantum key distribution exploits coherent measurements of the electromagnetic field, i.e., homodyne or heterodyne detection. The most advanced security proofs developed so far relied on idealised mathematical models for such measurements, which assume that the measurement outcomes are continuous and unbounded variables. As physical measurement devices have finite range and precision, these mathematical models only serve as an approximation. It is expected that, under suitable conditions, the predictions obtained using these simplified models are in good agreement with the …
We investigate the composable security of unidimensional contin- uous variable quantum key distribution (UCVQKD), which is based on the Gaussian modulation of a single quadrature of the coherent-state of light, aiming to provide a simple implementation of key distribution compared to the symmetrically modulated Gaussian coherent-state protocols. This protocol neglects the necessity in one of the quadrature modulation in coherent-states and hence reduces the system complexity. To clarify the influence of finite-size effect and the cost of performance degeneration, we establish the relation- shi…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
Long-distance quantum key distribution (QKD) has long time seriously relied on trusted relay or quantum repeater, which either has security threat or is far from practical implementation. Recently, a solution called twin-field (TF) QKD and its variants have been proposed to overcome this challenge. However, most security proofs are complicated, a majority of which could only ensure security against collective attacks. Until now, the full and simple security proof can only be provided with asymptotic resource assumption. Here, we provide a composable finite-key analysis for coherent-state-based…
We present a general framework encompassing a number of continuous-variable quantum key distribution protocols, including standard one-way protocols, measurement-device-independent protocols as well as some two-way protocols, or any other continuous-variable protocol involving only a Gaussian modulation of coherent states and heterodyne detection. The main interest of this framework is that the corresponding protocols are all covariant with respect to the action of the unitary group $U(n)$, implying that their security can be established thanks to a Gaussian de Finetti reduction. In particular…
We consider continuous-variable quantum key distribution with discrete-alphabet encodings. In particular, we study protocols where information is encoded in the phase of displaced coherent (or thermal) states, even though the results can be directly extended to any protocol based on finite constellations of displaced Gaussian states. In this setting, we provide a composable security analysis in the finite-size regime assuming the realistic but restrictive hypothesis of collective Gaussian attacks. Under this assumption, we can efficiently estimate the parameters of the channel via maximum like…
Gaussian networks are fundamental objects in network information theory. Here many senders and receivers are connected by physically motivated Gaussian channels while auxiliary Gaussian components, such as Gaussian relays, are entailed. Whilst the theoretical backbone of classical Gaussian networks is well established, the quantum analogue is yet immature. Here, we theoretically tackle composable security of arbitrary Gaussian quantum networks (quantum networks), with generally untrusted nodes, in the finite-size regime. We put forward a general methodology for parameter estimation, which is o…
We present a rigorous security analysis of Continuous-Variable Measurement-Device Independent Quantum Key Distribution (CV MDI QKD) in a finite size scenario. The security proof is obtained in two steps: by first assessing the security against collective Gaussian attacks, and then extending to the most general class of coherent attacks via the Gaussian de Finetti reduction. Our result combines recent state-of-the-art security proofs for CV QKD with new findings about min-entropy calculus and parameter estimation. In doing so, we improve the finite-size estimate of the secret key rate. Our conc…
A quantum key distribution (QKD) system must fulfill the requirement of universal composability to ensure that any cryptographic application (using the QKD system) is also secure. Furthermore, the theoretical proof responsible for security analysis and key generation should cater to the number $N$ of the distributed quantum states being finite in practice. Continuous-variable (CV) QKD based on coherent states, despite being a suitable candidate for integration in the telecom infrastructure, has so far been unable to demonstrate composability as existing proofs require a rather large $N$ for su…
Quantum key distribution (QKD) promises provably secure communications. In order to improve the secret key rate, combining a biased basis choice with the decoy-state method is proposed. Concomitantly, there is a basis-independent detection efficiency condition, which usually cannot be satisfied in a practical system, such as the time-phase encoding. Fortunately, this flaw has been recently removed theoretically and experimentally using the fact that the expected yields of single-photon states prepared in two bases stay the same for a given measurement basis. However, the security proofs do not…
We present a composably secure protocol allowing $n$ parties to test an entanglement generation resource controlled by a possibly dishonest party. The test consists only in local quantum operations and authenticated classical communication once a state is shared among them and provides composable security, namely it can be used as a secure subroutine by $n$ honest parties within larger communication protocols to test if a source is sharing quantum states that are at least $ε$-close to the GHZ state. This claim comes on top of previous results on multipartite entanglement verification where the…
The Universal Composability model (UC) by Canetti (FOCS 2001) allows for secure composition of arbitrary protocols. We present a quantum version of the UC model which enjoys the same compositionality guarantees. We prove that in this model statistically secure oblivious transfer protocols can be constructed from commitments. Furthermore, we show that every statistically classically UC secure protocol is also statistically quantum UC secure. Such implications are not known for other quantum security definitions. As a corollary, we get that quantum UC secure protocols for general multi-party com…
The performance of a practical continuous-variable (CV) quantum key distribution (QKD) protocol depends significantly, apart from the loss and noise of the quantum channel, on the post-processing steps which lead to the extraction of the final secret key. A critical step is the reconciliation process, especially when one assumes finite-size effects in a composable framework. Here, we focus on the Gaussian-modulated coherent-state protocol with heterodyne detection in a high signal-to-noise ratio regime. We simulate the quantum communication process and we post-process the output data by applyi…
We present methods to strictly calculate the finite-key effects in quantum key distribution (QKD) with error rejection through two-way classical communication (TWCC) for the sending-or-not-sending twin-field protocol. Unlike the normal QKD without TWCC, here the probability of tagging or untagging for each two-bit random group is not independent. We rigorously solve this problem by imagining a virtual set of bits where every bit is independent and identical. We show the relationship between the outcome starting from this imagined set containing independent and identical bits and the outcome st…
We provide a security analysis for continuous variable quantum key distribution protocols based on the transmission of squeezed vacuum states measured via homodyne detection. We employ a version of the entropic uncertainty relation for smooth entropies to give a lower bound on the number of secret bits which can be extracted from a finite number of runs of the protocol. This bound is valid under general coherent attacks, and gives rise to keys which are composably secure. For comparison, we also give a lower bound valid under the assumption of collective attacks. For both scenarios, we find po…
Continuous variable (CV) quantum key distribution (QKD) provides a powerful setting for secure quantum communications, thanks to the use of room-temperature off-the-shelf optical devices and the potential to reach much higher rates than the standard discrete-variable counterpart. In this work, we provide a general framework for studying the composable finite-size security of CV-QKD with Gaussian-modulated coherent-state protocols under various levels of trust for the loss and noise experienced by the parties. Our study considers both wired (i.e., fiber-based) and wireless (i.e., free-space) qu…
Fully integrated continuous-variable quantum key distribution with composable security over 100 km
Shanghai Jiao Tong University（上海交通大学）；Donghua University（东华大学）；Shanghai Research Center for Quantum Sciences（上海量子科学研究中心）；Hefei National Laboratory（合肥国家实验室）
Secret sharing is a multi-party cryptographic primitive that can be applied to a network of partially distrustful parties for encrypting data that is both sensitive (it must remain secure) and important (it must not be lost or destroyed). When sharing classical secrets (as opposed to quantum states), one can distinguish between protocols that leverage bi-partite quantum key distribution (QKD) and those that exploit multi-partite entanglement. The latter class are known to be vulnerable to so-called participant attacks and, while progress has been made recently, there is currently no analysis t…
High-rate multipartite quantum secret sharing with composable security
Institute of Photonics and Quantum Sciences, School of Engineering and Physical Sciences, Heriot-Watt University（赫瑞瓦特大学工程与物理科学学院光子与量子科学研究所）；Electrical Engineering and Computer Science Department, Technische Universität Berlin（柏林工业大学电气与计算机科学系）；Dahlem Center for Complex Quantum Systems, Freie Universität Berlin（柏林自由大学达勒姆复杂量子系统中心）
Barnum, Crepeau, Gottesman, Tapp, and Smith (quant-ph/0205128) proposed methods for authentication of quantum messages. The first method is an interactive protocol (TQA') based on teleportation. The second method is a noninteractive protocol (QA) in which the sender first encrypts the message using a protocol QEnc and then encodes the quantum ciphertext with an error correcting code chosen secretly from a set (a purity test code (PTC)). Encryption was shown to be necessary for authentication. We augment the protocol QA with an extra step which recycles the entire encryption key provided QA acc…
We introduce a protocol between a classical polynomial-time verifier and a quantum polynomial-time prover that allows the verifier to securely delegate to the prover the preparation of certain single-qubit quantum states. The protocol realizes the following functionality, with computational security: the verifier chooses one of the observables $Z$, $X$, $Y$, $(X+Y)/\sqrt{2}$, $(X-Y)/\sqrt{2}$; the prover receives a uniformly random eigenstate of the observable chosen by the verifier; the verifier receives a classical description of that state. The prover is unaware of which state he received a…
Privacy amplification is the art of shrinking a partially secret string Z to a highly secret key S. We show that, even if an adversary holds quantum information about the initial string Z, the key S obtained by two-universal hashing is secure, according to a universally composable security definition. Additionally, we give an asymptotically optimal lower bound on the length of the extractable key S in terms of the adversary's (quantum) knowledge about Z. Our result has applications in quantum cryptography. In particular, it implies that many of the known quantum key distribution protocols are …
We propose an efficient four-intensity decoy-state BB84 protocol and derive concise security bounds for this protocol with the universally composable finite-key analysis method. Comparing with the efficient three-intensity protocol, we find that our efficient four-intensity protocol can increase the secret key rate by at least $30\%$. Particularly, this increasing rate of secret key rate will be raised as the transmission distance increases. At a large transmission distance, our efficient four-intensity protocol can improve the performance of quantum key distribution profoundly.
Quantum Key Distribution is a secret distribution technique that requires an authenticated channel. This channel is usually created on top of an un-authenticated communication medium using unconditionally secure Message Authentication Codes (MAC) and an initial common secret. We examine the consequences of replacing this MAC algorithm by a cryptographic hash-based signature algorithm, like the Lamport algorithm. We show that provided one-way functions exist, the Lamport algorithm or its variants can be instantiated in a secure way in the Universally Composable sense, and can therefore be plugg…
We show that, if the accessible information is used as a security quantifier, quantum channels with a certain symmetry can convey private messages at a tremendously high rate, as high as less than one bit below the rate of non-private classical communication. This result is obtained by exploiting the quantum data locking effect. The price to pay to achieve such a high private communication rate is that accessible information security is in general not composable. However, composable security holds against an eavesdropper who is forced to measure her share of the quantum system within a finite …
Quantum message authentication codes are families of keyed encoding and decoding maps that enable the detection of tampering on encoded quantum data. Here, we study a new class of simulators for quantum message authentication schemes, and show how they are applied in the context of two codes: the Clifford and the trap code. Our results show for the first time that these codes admit an efficient simulation (assuming that the adversary is efficient). Such efficient simulation is typically crucial in order to establish a composable notion of security.
Unconditional Security of Discrete-Modulated CV-QKD from Infinite-Dimensional MEAT
University of Waterloo（滑铁卢大学）；National University of Singapore（新加坡国立大学）；Technische Universität Wien（维也纳工业大学）；AIT Austrian Institute of Technology（奥地利技术研究院）
We present a composable security proof, valid against arbitrary attacks and including finite-size effects, for a high dimensional time-frequency quantum key distribution (TFQKD) protocol based upon spectrally entangled photons. Previous works have focused on TFQKD schemes as it combines the impressive loss tolerance of single-photon QKD with the large alphabets of continuous variable (CV) schemes, which enables the potential for more than one bit of secret key per transmission. However, the finite-size security of such schemes has only been proven under the assumption of collective Gaussian at…
The notion of simulatable security (reactive simulatability, universal composability) is a powerful tool for allowing the modular design of cryptographic protocols (composition of protocols) and showing the security of a given protocol embedded in a larger one. Recently, these methods have received much attention in the quantum cryptographic community. We give a short introduction to simulatable security in general and proceed by sketching the many different definitional choices together with their advantages and disadvantages. Based on the reactive simulatability modelling of Backes, Pfitzman…
Free-space channels provide the possibility of establishing continuous-variable quantum key distribution (CV-QKD) in global communication networks. However, the fluctuating nature of transmissivity in these channels introduces an extra noise which reduces the achievable secret key rate. We consider two classical post-processing strategies, post-selection of high-transmissivity data and data clusterization, to reduce the fluctuation-induced noise of the channel. We undertake the first investigation of such strategies utilising a composable security proof in a realistic finite-size regime agains…
We investigate the performance of Gaussianmodulated coherent-state QKD protocols in the presence of canonical attacks, which are collective Gaussian attacks resulting in Gaussian channels described by one of the possible canonical forms. We present asymptotic key rates and then we extend the results to the finite-size regime using a recently-developed toolbox for composable security.
At CRYPTO 2013, Boneh and Zhandry initiated the study of quantum-secure encryption. They proposed first indistinguishability definitions for the quantum world where the actual indistinguishability only holds for classical messages, and they provide arguments why it might be hard to achieve a stronger notion. In this work, we show that stronger notions are achievable, where the indistinguishability holds for quantum superpositions of messages. We investigate exhaustively the possibilities and subtle differences in defining such a quantum indistinguishability notion for symmetric-key encryption …
